The bank account matched. It still wasn't the supplier's.
OpenAuditor evidence-origin investigation

All businesses, people, identifiers and account numbers are fictional.
The two upstream histories are stipulated synthetic scenarios, not customer
records, observed fraud, or independently established account ownership.

Recorded engine revision: 6205721f91352039de5ce861c1c94d15d9903c7d
Original local run: 2026-10-02 UTC
Canonical request SHA-256 recorded in the responses:
f5ec1453238f7cb339f51b4a274fd1728337e312fa679cf9954577bf950026d5

INSPECT THE EXPERIMENT

Requires Python 3.10 or later. No API key, model or third-party package is
needed. From the directory containing the downloaded ZIP:

unzip evidence-origin.zip
python3 evidence-origin/check_results.py

The standalone checker reads the published JSON files. It verifies the
canonical request hash, equality of recorded responses after removing only
verification run IDs and creation timestamps, seven holds outcomes, two true
verdicts, unmeasured certainty, and zero recorded model questions. It also
checks that comparison.json agrees with the response files.

This checks the packet's internal consistency. It does not execute the
verification engine, authenticate its original execution, or establish the
truth of the stipulated business histories. No engine source is included.
Rerunning the engine requires access to the private source at the revision
recorded above. The checker uses only the Python standard library, writes no
files and makes no network or model calls.

FILES

paired-request.json: The identical request used in the recorded runs.
paired-worlds.json: Two different upstream histories, intentionally not input
                   to the engine. They are research metadata, not API fields.
world_a-response.json: Recorded response from the original local run.
world_b-response.json: Recorded response from the second local run.
comparison.json: Recorded equality and assertion summary, with source revision.
check_results.py: Standalone checker for the published files, not an engine replay.
README.txt: These instructions and limitations.

WHAT THE RESULT MEANS

The bank-change item checks recorded verifier separation, supported method,
and whether supplied payments occurred before the recorded verification date.
The payment item checks five supplied-record conditions. Invoice and employee
records are context; invoice verification and payment-release checks do not
run. No three-way match, source authentication or audit opinion is performed.

All seven assertions hold and both recorded item verdicts are true. The engine
reported probability_true 1.0000 on a deterministic basis, but certainty is
unmeasured. Neither number establishes the probability of real account ownership.
Input and results are the same because the contact-source distinction is omitted
from the request. More copies of that input cannot supply the distinction.

The comparison preserves assertion IDs, facts, pointers, configuration, risk,
usage and input hash. Only verification envelope IDs and timestamps are
excluded because they describe a particular execution.

ARTICLE

https://openauditor.ai/blog/audit-evidence-and-audit-trails

PRIMARY SOURCES

PCAOB AS 1105 (particularly .05, .07-.10A):
https://pcaobus.org/oversight/standards/auditing-standards/details/AS1105

FBI business email compromise guidance:
https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/business-email-compromise
